It’s a reasonable idea. It’s sort of halfway between a traditional VPN (where all your traffic passes through a VPN provider whom you must trust, as they know who you are and every site you access) and Tor (which passes your browsing through three anonymized volunteer-run servers, no one of which knows who you are and where you’re going). Obscura uses their own entry point (“guard relay” in Tor parlance) and a third-party (Mullvad) exit point. The guard knows who you are (at least your IP address, and whatever information they get from your payment method), but the data is encrypted on your device and passed through the guard to the exit, so the guard knows very little about your data. They don’t know what sites you visit and exactly what data you exchange with them, but they can get a broad picture of your usage (when you’re online, and probably when you’re streaming video or audio vs. reading email or surfing web pages).
The exit doesn’t know who you are, just that you’re an Obscura user. Your device IP address is (mostly) hidden from the sites you visit. There are a panoply of de-anonymization attacks that work against most browsers, though, which is a big reason that Tor uses its own browser (a hardened fork of Firefox). Of course, if Mullvad and Obscura have a special relationship (which they do, obviously) they can easily exchange user information and you’re back to what you’d have with a crooked or sloppy VPN operator, but the fact that you’d probably need two bad players (or rogue employees, or incompetent programmers) does make it safer.
Tomes have been written about the privacy and security (or lack thereof) of cryptocurrency payment systems, but they’re certainly likely to be safer than whipping out your American Express card. I assume other VPN providers offer cryptocurrency payments also, though.
Of course, you have to trust that the VPN client apps themselves aren’t faulty or otherwise corrupt, but Obscura offer you a way to configure your own WireGuard instance to work with their systems. WireGuard is FOSS and well scrutinized. That doesn’t make it perfect, but with proprietary products it’s a lot harder to do more than “just trust us.” They say that their source code is available, but that reproducible builds are planned for the future. They don’t say whether or not you can build your own client now, so I’m guessing from their wording that isn’t supported. Unless/until it is, you’re back to the same “just trust us” model that you have with proprietary products. Were I using Obscura, I’d opt for the WireGuard client configuration even though you lose some of Obscura’s privacy features (QUIC protocol).
“We…never log your IP address” is, of course, just a pinky-swear.
As always with security products, if you are just asking “Is this secure?” then the answer must be “Against what?” If you’re planning an adversarial action against a nation-state, sticking with Tor is probably your best bet (and far from bulletproof). If you really cannot articulate a threat model, then perhaps you don’t really need a VPN at all.
I’m not qualified to weigh in on the legal implications. I suppose the fact that a government agent would have to subpoena both Obscura and Mullvad to find out who you are and where you’re surfing would be something of a barrier, but if your adversary is a state actor, you’d best consult a lawyer.